fix: validate ORIGIN env var at startup #15045

KiraPC · 2025-12-09T14:49:33Z

Add parse_origin() utility to validate and normalize origin URLs
Server now fails fast with clear error for invalid ORIGIN
Automatically normalize default ports and strip path/query/hash
Add tests for origin validation

Closes #14978

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
This message body should clearly illustrate what problems it solves.
Ideally, include a test that fails without this PR but passes with it.

Tests

Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

- Add parse_origin() utility to validate and normalize origin URLs - Server now fails fast with clear error for invalid ORIGIN - Automatically normalize default ports and strip path/query/hash - Add tests for origin validation

changeset-bot · 2025-12-09T14:49:37Z

🦋 Changeset detected

Latest commit: 52b796c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/adapter-node	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

KiraPC · 2025-12-09T15:07:03Z

⚠️ No Changeset found

Latest commit: c754c30

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets
Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Added the changeset

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* checkpoint * donesies * fix: lockfile * update svelte-check * add .env for test app * fix flaky test * polyfill withResolvers

) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: Ben McCann <[email protected]>

…s#15077)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Tiny detail to make it super clear the import is for remote functions.

Co-authored-by: Ben McCann <[email protected]>

* chore: Upgrade Playwright * checkpoint, not sure what else is going wrong * i have never been so happy to see a test failure * fix lockfile maybe * fix: remove playwright * more flaky tests * fix clicknav * fix another flaky test * improve further * another clicknav usage

…tejs#14725) * improvement: expose `waitUntil` also for serverless runtime & add documentation * changeset * revert previous changes and add docs * revert previous changes * change changeset --------- Co-authored-by: Tee Ming <[email protected]>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tee Ming <[email protected]>

Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: teemingc <[email protected]> Co-authored-by: Ben McCann <[email protected]>

* docs: remove `$lib` path customization Updated documentation for $lib import alias in SvelteKit. * Update documentation/docs/98-reference/26-$lib.md Co-authored-by: Tee Ming <[email protected]> * chore: remove deprecated comment --------- Co-authored-by: Tee Ming <[email protected]>

…5127)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

) * Add support for SearchParams.has(name, value) overload * generate changeset * Update .changeset/sharp-tires-work.md --------- Co-authored-by: Elliott Johnson <[email protected]> Co-authored-by: Elliott Johnson <[email protected]>

.changeset/dry-hornets-change.md

@teemingc

…eltejs#15153) * add fix and test format * add unit test * changeset * add test for inlining conditionally rendered component css * format * Apply suggestion from @teemingc * Apply suggestion from @teemingc * Update css.js * handle whitespace, add some additional test cases * add failing test for assets in static dir * bump svelte * this should just work * fix lockfile * ok its working now * last fix * format * push wip * tests are passing * split tests * rename parser to parse * hoist regexes * use test.each * add test for content and comments * rename assets to paths_assets * add tests for escaped characters * add test for encoded characters * safeguard against trailing slashes * decode vite asset filenames * a bit of clean up * oops * tippex comments * tippex strings * tippex wip * harden comment and escaped character tests * account for nested app dir * bump svelte * chore: fix tippex and add test cases --------- Co-authored-by: Elliott Johnson <[email protected]> Co-authored-by: Rich Harris <[email protected]>

Co-authored-by: Elliott Johnson <[email protected]> Co-authored-by: Rishab49 <[email protected]>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…veltejs#15216)

…in package.json of public packages (sveltejs#15217)

…ejs#15221)

@GauBen

…sveltejs#15231) * fix(kit): properly handle percent-encoded anchors during prerendering * changelog * Apply suggestion from @GauBen * improve tests --------- Co-authored-by: Elliott Johnson <[email protected]>

@teemingc

* feat: export type Picture in enhanced-img This type is part of public api, so it should be reexported. Otherwise users have to explicitly add "vite-imagetools", or use hacks like `typeof import('fake.jpg?enhanced').default` This type is needed when using `import.meta.glob`, because by default it is getting typed as `unknown`. * Apply suggestion from @teemingc Co-authored-by: Tee Ming <[email protected]> * tweak --------- Co-authored-by: Elliott Johnson <[email protected]> Co-authored-by: Tee Ming <[email protected]>

# Conflicts: # packages/adapter-node/tests/utils.spec.js

elliott-with-the-longest-name-on-github

One more thing and I think we're good!

packages/adapter-node/utils.js

packages/adapter-node/src/handler.js

benmccann · 2026-02-04T17:16:28Z

I just wanted to say thanks and sorry for the delay! We avoided reviewing this earlier so as not to conflict with getting some security fixes out:

d9ae9b0#diff-216dce32a326b5829e531e0315d25a9e5feaab9175dc9a489d3a7d498afe63d4

You were very close to fixing the security issue without knowing it 😄

KiraPC · 2026-02-04T19:55:25Z

I just wanted to say thanks and sorry for the delay! We avoided reviewing this earlier so as not to conflict with getting some security fixes out:

d9ae9b0#diff-216dce32a326b5829e531e0315d25a9e5feaab9175dc9a489d3a7d498afe63d4

You were very close to fixing the security issue without knowing it 😄

No worries at all, security comes first! That's pretty funny that I was close to fixing it without knowing 😄

Thanks for reviewing and for building such an amazing framework, really enjoying working with SvelteKit!

svelte-docs-bot · 2026-02-04T19:56:46Z

Preview: https://svelte-dev-git-preview-kit-15045-svelte.vercel.app/

Co-authored-by: Elliott Johnson <[email protected]>

teemingc · 2026-02-05T21:10:05Z

Oh man the git history was a little wonky and I forgot to fix up the merge commit description 🤦🏼

add changeset

62bbeb1

chore(deps): update pnpm to v10.25.0 (sveltejs#15043)

61578e1

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

teemingc added the pkg:adapter-node label Dec 12, 2025

elliott-with-the-longest-name-on-github and others added 20 commits December 12, 2025 17:09

chore: Test remote functions with full-async setup (sveltejs#15033)

2cfcfac

* checkpoint * donesies * fix: lockfile * update svelte-check * add .env for test app * fix flaky test * polyfill withResolvers

chore(deps): update actions/upload-artifact action to v6 (sveltejs#15057

475ea75

) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update pnpm to v10.26.0 (sveltejs#15065)

8e0aea3

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix: make typescript an optional peer dependency (sveltejs#15074)

5fed053

Co-authored-by: Ben McCann <[email protected]>

docs: update Wrangler command for Cloudflare Workers testing (sveltej…

a01df4c

…s#15077)

chore(deps): update pnpm to v10.26.2 (sveltejs#15072)

de8051b

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

docs: clarify remote function import (sveltejs#15082)

46f2eaf

Tiny detail to make it super clear the import is for remote functions.

docs: update description for static folder (sveltejs#15087)

966d33c

Co-authored-by: Ben McCann <[email protected]>

chore: upgrade jws (sveltejs#15095)

5c385cf

chore: upgrade js-yaml (sveltejs#15096)

307588e

chore(deps): update vitest monorepo to v4 (major) (sveltejs#14789)

8c952a7

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tee Ming <[email protected]>

fix: avoid overridden Vite config warning with Vitest 4 (sveltejs#15121)

89ac4a0

Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: teemingc <[email protected]> Co-authored-by: Ben McCann <[email protected]>

fix: use hasOwn check when deep-setting object properties (sveltejs#1…

8923a48

…5127)

Version Packages (sveltejs#15091)

cf29465

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: upgrade to pnpm 10.27.0 (sveltejs#15128)

52b705d

Merge branch 'main' into 14978

cdf7224

teemingc changed the title ~~fix(adapter-node): validate ORIGIN env var at startup (#14978)~~ fix(adapter-node): validate ORIGIN env var at startup Jan 6, 2026

teemingc changed the title ~~fix(adapter-node): validate ORIGIN env var at startup~~ fix: validate ORIGIN env var at startup Jan 6, 2026

teemingc reviewed Jan 6, 2026

View reviewed changes

.changeset/dry-hornets-change.md Outdated Show resolved Hide resolved

teemingc reviewed Jan 6, 2026

View reviewed changes

.changeset/dry-hornets-change.md Outdated Show resolved Hide resolved

benmccann and others added 12 commits January 27, 2026 01:40

chore: upgrade netlify/dev library (sveltejs#15210)

62741e3

fix: use validated args in batch resolver (sveltejs#15215)

374d859

Co-authored-by: Elliott Johnson <[email protected]> Co-authored-by: Rishab49 <[email protected]>

chore(deps): update dependency set-cookie-parser to v3 (sveltejs#15155)

e92257b

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix: only match rest params with matchers when the matcher matches (s…

f47cb08

…veltejs#15216)

chore: restore previous explicit version for magic-string dependency …

8024a02

…in package.json of public packages (sveltejs#15217)

fix: emit script CSP nonces when is present if is also present (svelt…

327257b

…ejs#15221)

Update pnpm-workspace.yaml (sveltejs#15218)

6ad0682

Merge remote-tracking branch 'origin/main' into 14978

677d56e

# Conflicts: # packages/adapter-node/tests/utils.spec.js

handle pr review comments

ac2a038

KiraPC force-pushed the 14978 branch from 69001b6 to f0f0105 Compare February 1, 2026 11:29

elliott-with-the-longest-name-on-github reviewed Feb 3, 2026

View reviewed changes

packages/adapter-node/utils.js Outdated Show resolved Hide resolved

packages/adapter-node/src/handler.js Show resolved Hide resolved

fix: address PR review comments

6299b1d

KiraPC force-pushed the 14978 branch from 1eeeb46 to 6299b1d Compare February 5, 2026 08:11

KiraPC and others added 4 commits February 5, 2026 09:15

Merge branch 'main' into 14978

03cb548

chore: remove obsolete changesets consumed by releases

909c5e3

Merge branch 'main' into 14978

180b478

Apply suggestion from @elliott-with-the-longest-name-on-github

c543c10

Co-authored-by: Elliott Johnson <[email protected]>

teemingc approved these changes Feb 5, 2026

View reviewed changes

cleanup

c1c1130

elliott-with-the-longest-name-on-github mentioned this pull request Feb 5, 2026

fix: validate ORIGIN env variable includes protocol in adapter-node #15261

Closed

silly github

52b796c

teemingc merged commit 80f5bbc into sveltejs:main Feb 5, 2026
22 checks passed

github-actions bot mentioned this pull request Feb 5, 2026

Version Packages #15241

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: validate ORIGIN env var at startup #15045

fix: validate ORIGIN env var at startup #15045

KiraPC commented Dec 9, 2025 •

edited by teemingc

Loading

Uh oh!

changeset-bot bot commented Dec 9, 2025 •

edited

Loading

Uh oh!

KiraPC commented Dec 9, 2025

⚠️ No Changeset found

Uh oh!

Uh oh!

Uh oh!

elliott-with-the-longest-name-on-github left a comment

Uh oh!

Uh oh!

Uh oh!

benmccann commented Feb 4, 2026

Uh oh!

KiraPC commented Feb 4, 2026

Uh oh!

svelte-docs-bot bot commented Feb 4, 2026

Uh oh!

Uh oh!

teemingc commented Feb 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Uh oh!

fix: validate ORIGIN env var at startup #15045

fix: validate ORIGIN env var at startup #15045

Conversation

KiraPC commented Dec 9, 2025 • edited by teemingc Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

Tests

Changesets

Edits

Uh oh!

changeset-bot bot commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

KiraPC commented Dec 9, 2025

⚠️ No Changeset found

Uh oh!

Uh oh!

Uh oh!

elliott-with-the-longest-name-on-github left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

benmccann commented Feb 4, 2026

Uh oh!

KiraPC commented Feb 4, 2026

Uh oh!

svelte-docs-bot bot commented Feb 4, 2026

Uh oh!

Uh oh!

teemingc commented Feb 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

KiraPC commented Dec 9, 2025 •

edited by teemingc

Loading

changeset-bot bot commented Dec 9, 2025 •

edited

Loading